CVE-2025-1510 is a code injection vulnerability (CWE-94) in the Custom Post Type Date Archives plugin for WordPress. The plugin improperly controls the generation of code by allowing execution of arbitrary shortcodes without proper validation in all versions up to and including 2.7.1. This enables unauthenticated attackers to run arbitrary shortcode actions, potentially impacting confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes, which may lead to partial compromise of confidentiality, integrity, and availability of the WordPress site using the vulnerable plugin. The CVSS score of 7.3 reflects a high severity impact, but no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's channels for updates. Until a fix is available, consider disabling or removing the vulnerable plugin to prevent exploitation.